search

systopia / CiviProxy

A security proxy for CiviCRM
GNU Affero General Public License v3.0
7 stars 18 forks source link

Support API4 #66

Closed ejegg closed 2 months ago

ejegg commented 1 year ago

It's the wave of the future!

bjendres commented 1 year ago

It's the wave of the future!

Couldn't agree more. Are you going to be working on this, or just putting it out there?

ejegg commented 1 year ago

I hope to get it working! I'm just looking it over now. I see we will at least have to allow passing '4' as a value for 'version', and will have to pass through urls of the format civicrm/ajax/api4/entity/action. I was thinking of adding an .htacess file to help with the latter, mapping the /entity/action path segments to query string parameters and passing them to civiproxy's rest.php.

Do you have any further suggestions?

bjendres commented 1 year ago

I was thinking of adding an .htacess file to help with the latter, mapping the /entity/action path segments to query string parameters and passing them to civiproxy's rest.php. Do you have any further suggestions?

Hm, I haven't spent much thought on it, but that sounds plausible.

However, another approach would be to add a separate rest4.php endpoint. This has a couple of advantages:

  1. Easier to implement
  2. Easier to add api4 concepts
  3. Easier to separately enable/disable api3 and api4
  4. Less complicated code - and complicated code is the enemy of security :)

Think about it.

ejegg commented 1 year ago

OK @bjendres I have added a separate rest4.php endpoint in the linked pull request, along with a .htaccess file to rewrite API4 style requests coming in to civiproxy so rest4.php sees the entity and action on the querystring.